NimbostratusDNSSEC DS record upload -HOWTO- ??
Hello Folks
I'm setting up a DNSSEC environment using RHEL server with BIND as my primary/master DNS server and delegating (via CNAMES) intelligent resolution( through wide-ips) to my GTM box.
I have set one zone (3gnetworks.cr.) with standard records (SOA, NS, A) BUT i have not done any DNSSEC setup at the server level.
I already went through the whole process on configuring DNSSEC on my GTM box so if i query directly the GTM ( 192.168.20.253) for the wide-ip configured on the box works as expected!
[glenn@MyDNS ~]$ dig @192.168.20.253 misubasta.3gnetworks.cr +dnssec
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_4.2 <<>> @192.168.20.253 misubasta.3gnetworks.cr +dnssec
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2837
;; flags: qr aa rd ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 2048
;; QUESTION SECTION:
;misubasta.3gnetworks.cr. IN A
;; ANSWER SECTION:
misubasta.3gnetworks.cr. 30 IN A 192.168.20.6
misubasta.3gnetworks.cr. 30 IN RRSIG A 7 3 30 20130716080024 20130709080023 54335 3gnetworks.cr. TNElaYQLSBBRaWBtZmp4r0s1C+KHmMB4vAJivA+biXewUr6ToEXLD6xL PKQxvPDByJA85OkltII1lrfw49B0EDs9ZEYGrDQUr8D/U5VWvv5+ZQYw EmR4icuSeHedw+8bNECvMFtCa4ZC38ANUCO0ZfVq3KmOuJjZYF3WNqKL Wmo=
++++++++++++++++++++end of output++++++++++++++++++++++++++++++++++++++
BUT if I query my primary DNS server (192.168.20.250)
[glenn@MyDNS ~]$ dig @192.168.20.250 misubasta.3gnetworks.cr +dnssec
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_4.2 <<>> @192.168.20.250 misubasta.3gnetworks.cr +dnssec
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64191
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;misubasta.3gnetworks.cr. IN A
;; ANSWER SECTION:
misubasta.3gnetworks.cr. 38400 IN CNAME wideip.misubasta.3gnetworks.cr.
wideip.misubasta.3gnetworks.cr. 30 IN A 192.168.20.6
;; AUTHORITY SECTION:
wideip.misubasta.3gnetworks.cr. 38400 IN NS gtm2.wideip.misubasta.3gnetworks.cr.
wideip.misubasta.3gnetworks.cr. 38400 IN NS gtm1.wideip.misubasta.3gnetworks.cr.
I dont get the RRSIG Record for misubasta.3gnetworks.cr
What I think Im missing is the DS record I need to upload from my GTM to my parent zone ( in this case 3gnetworks.cr)
if I take a look at the DSSET file i can see the DS record
[root@malpais:Active:Standalone] config cat /config/gtm/dsset-3gnetworks.cr
3gnetworks.cr. 86400 IN DS 9921 7 1 1936bf2f16e3569dd55d756e3ff4b82998882f5b
{key = /Common/3gKSK, gen = 1}
MY QUESTION WOULD BE:
How to upload the DS record to my BIND server to establish the chain of trust?
Thanks in advanced folks!!!
